News & Insights  |  Media Mentions

Related Professionals

Practice Areas


Patricia O'Connell
Senior Communications Manager

Kirk Nahra Comments on LabMD v. FTC Case Being Argued Before Eleventh Circuit

June 21, 2017

Kirk J. Nahra, chair of Wiley Rein’s Privacy & Cybersecurity Practice, was quoted in a June 20 Law360 article on a pivotal case, LabMD v. FTC, that may help determine the Federal Trade Commission’s (FTC) authority to regulate corporate data security. The case, scheduled for argument before the Eleventh Circuit today, was propelled forward after the FTC, in July 2016, overturned a ruling by its own administrative judge. The commissioners concluded that LabMD had not employed essential security systems to protect individuals’ medical data and, as a result, caused “substantial” harm to consumers in violation of Section 5 of the FTC Act. In the absence of direct enforcement authority, the FTC has relied on Section 5 as a catch-all prohibition against unfair and deceptive trade practices, and as a means for the agency to enforce data security compliance.

“If the court seems interested in restricting the FTC’s activities to situations that involve only some higher level of consumer harm, that will have a material impact on FTC activity in general,” Mr. Nahra told Law360. He also pointed out that such a conclusion would put the agency in a parallel position to plaintiffs in regards to showing harm, while distinguishing the FTC from other privacy regulators that don’t need to demonstrate harm in order to use their enforcement powers.

“If the court is at all sympathetic to LabMD on this issue, that would be enormous – that’s the premise of all of the FTC’s data security cases,” said Mr. Nahra. “That would create the possibility of a huge gap in security enforcement, and in theory could push Congress to actually act in this area.”

“This has always been a weird case – the security problems that were identified, while clearly not good, may not have been anywhere near as bad as many other cases,” Mr. Nahra added. “So the narrowest reading of this case – which is possible – would be that the FTC made a mistake on the facts of this case, without the court getting into any broader philosophical discussion.”